TI-2026-82752 CVE-2026-119202 · GHSA-8494-f6mr-cjpv
Quadratic-time parsing in @hapi/content allows denial of service
Priority HIGH 72
@hapi/content provides HTTP Content-* header parsing.
hapijs
Records22All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
hapijs records in CISA KEVNo hapijs vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
22 records
TI-2026-82716 CVE-2026-118772 · GHSA-4528-x5fx-h6hg
Quadratic-time split in joi email rule allows denial of service
Priority HIGH 72
joi is a schema description language and data validator for JavaScript.
TI-2026-61678 CVE-2026-90771 · GHSA-wr44-6hxh-3jwq
joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
Priority MEDIUM 61
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code.
TI-2018-02726 CVE-2018-3728 · GHSA-jp4x-w63m-7wgm
Prototype pollution in @hapi hoek node module
Priority MEDIUM 45
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the pro…
TI-2026-79747 CVE-2026-115728 · GHSA-vwgx-c45f-9873
Regular expression denial of service in @hapi/content disposition parsing
Priority MEDIUM 44
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213.
TI-2026-62455 CVE-2026-92599 · GHSA-mrx9-2rrp-rhpx
Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
Priority MEDIUM 44
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule.
TI-2026-27366 CVE-2026-35213 · GHSA-jg4p-7fhp-p32p
Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing
Priority MEDIUM 44
@hapi/content provided HTTP Content-* headers parsing.
TI-2026-32836 CVE-2026-44974 · GHSA-36hh-x5p5-jgc8
Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters
Priority MEDIUM 42
@hapi/content provided HTTP Content-* headers parsing.
TI-2020-18803 CVE-2020-36604 · GHSA-c429-5p7v-vgjp
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Priority MEDIUM 40
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
TI-2015-07620 CVE-2015-9241 · GHSA-rc8h-3fv6-pxv8
Uncontrolled resource consumption in HackerOne hapi node module
Priority LOW 37
Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised.
TI-2017-11738 CVE-2017-16013 · GHSA-cqjg-whmm-8gv6
Uncontrolled resource consumption in HackerOne hapi node module
Priority LOW 36
hapi is a web and services application framework.
TI-2026-35491 CVE-2026-48049 · GHSA-rcvq-m9j9-6f4g
@hapi/inert: Static-file confinement bypass via sibling-prefix path
Priority LOW 31
@hapi/inert provides static file and directory handlers for hapi.js.
TI-2026-35481 CVE-2026-48038 · GHSA-q7cg-457f-vx79
joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
Priority LOW 31
joi is a schema description language and data validator for JavaScript.
TI-2023-10628 CVE-2023-25166 · GHSA-c2jc-4fpr-4vhg
Regular expression denial of service (ReDoS) in hapijs formula
Priority LOW 30
formula is a math and string formula parser.
TI-2017-11750 CVE-2017-16025 · GHSA-3pwh-5mmc-mwrx
Uncontrolled resource consumption in HackerOne nes node module
Priority LOW 30
Nes is a websocket extension library for hapi.
TI-2026-85172 CVE-2026-122131 · GHSA-gw37-7cc7-xmm6
Joi prototype replacement via __proto__ language key
Priority LOW 28
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key.
TI-2026-35466 CVE-2026-48022 · GHSA-x426-x7cc-3fpc
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
Priority LOW 28
@hapi/wreck is an HTTP client utility.
TI-2026-32840 CVE-2026-44979 · GHSA-vhjm-w67q-g75c
@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects
Priority LOW 28
@hapi/wreck is an HTTP client utility.
TI-2015-07622 CVE-2015-9243 · GHSA-j3g2-m5jj-6336
Improper access control in HackerOne hapi node module
Priority LOW 28
When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher level config included security restrictions (like origin), a higher level config tha…
TI-2015-07616 CVE-2015-9236 · GHSA-vwrf-r5r4-7775
Improper access control in HackerOne hapi node module
Priority LOW 27
Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at worst allowed cross-origin activities that were expected to be forbidden.
TI-2026-57979 CVE-2026-84368 · GHSA-6w3j-5fw6-r9vr
joi: Prototype pollution via a `__proto__` language key in custom messages
Priority LOW 18
joi is a schema description language and data validator for JavaScript.
TI-2026-57978 CVE-2026-84367 · GHSA-gg4h-3hg2-grpc
joi: object().rename() with a template target can set the validated object's prototype
Priority LOW 18
joi is a schema description language and data validator for JavaScript.